ransomware_app[.]zip

General

Target
ransomware_app.zip
Size 5KB
Sample260916-27n89afd73
SHA256 db8373433e1307993a0535de02f5c84e365b9c35a8e12c0c72f0d627180e64cc
MD5 b1ae31f89a0c6ab8903eabff3d270a30
SHA1 98f924cbcbf79ed7d1c4c77c88efe4bda4a89f22
SHA512 dce20426f97b2a77b330d3212dbc5adf8bc51fb77d92e35856966e5eea7f1af16cb9110866c36774ba7b62595f6c3ac7854ee58219dbe688fba27afb466975e2
SSDEEP 96:tucHy1G8RmfvK+d91AoxoLS/XYt13ZCVYO8UuuMYW683+SSM5:tJHy1G8Ryp/HxoL2ImfgubW6mhSM5
TLSH
T142C18C845EE4EBB3EB28033F6C614943240301DDB9F7C3698450D65AABA709B9B3F54E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/RansomwareApp.exe

File Explorer

ransomware_app.zip

.zip 5KB
RUN_DOUBLECLICK.bat

433B
RansomwareApp.exe

.exe 4KB
payload_v2.py

7KB

ransomware_app.zip

SHA256 db8373433e1307993a0535de02f5c84e365b9c35a8e12c0c72f0d627180e64cc
MD5 b1ae31f89a0c6ab8903eabff3d270a30
SHA1 98f924cbcbf79ed7d1c4c77c88efe4bda4a89f22
SHA512 dce20426f97b2a77b330d3212dbc5adf8bc51fb77d92e35856966e5eea7f1af16cb9110866c36774ba7b62595f6c3ac7854ee58219dbe688fba27afb466975e2
SSDEEP 96:tucHy1G8RmfvK+d91AoxoLS/XYt13ZCVYO8UuuMYW683+SSM5:tJHy1G8Ryp/HxoL2ImfgubW6mhSM5
TLSH
T142C18C845EE4EBB3EB28033F6C614943240301DDB9F7C3698450D65AABA709B9B3F54E
MD5 SHA1 SHA512 SSDEEP TLSH

RansomwareApp.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 9dd3e0f8422e8c33909854a2e820c9c958dd874c20ff596c587d5c9df71316cc
MD5 60442808b076bcd24e36f7c0ddfbea48
SHA1 3955acadea8c95c91c411e7aa1b1728a7bb5b1ec
SHA512 5089cb9d1af4de6ef219b12f2a6076685d6d625a043360bf542393434d4b53420406d2c9c50577986b8761f4219c7f53055bebeee3c6c02fc95edb8ba0c4356b
SSDEEP 48:6fTfrVui3tsuAJRLxo7jhIBFc6bs7V6jCsXVYOulCcLgDqXSfbNtm:QrVui3tsud79M5HjCsgUcLg9zNt
TLSH
T1FD916601E7E8463BE0FB4B306EF3631263B9FB514977875E2CD842196D2666088627F1
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10062

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ransomware_app.zip

RUN_DOUBLECLICK.bat

RansomwareApp.exe

mscoree

dotnet

payload_v2.py

Sharing

General

Malware Config

Signatures

File Explorer

ransomware_app.zip

RUN_DOUBLECLICK.bat

RansomwareApp.exe

mscoree

dotnet

payload_v2.py